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Abstract 

The ability to detect weak distributed activation patterns in networks is critical to several applica- 
tions, such as identifying the onset of anomalous activity or incipient congestion in the Internet, or faint 
traces of a biochemical spread by a sensor network. This is a challenging problem since weak distributed 
patterns can be invisible in per node statistics as well as a global network-wide aggregate. Most prior 
work considers situations in which the activation/non-activation of each node is statistically indepen- 
dent, but this is unrealistic in many problems. In this paper, we consider structured patterns arising 
from statistical dependencies in the activation process. Our contributions are three-fold. First, we pro- 
pose a sparsifying transform that succinctly represents structured activation patterns that conform to a 
hierarchical dependency graph. Second, we establish that the proposed transform facilitates detection of 
very weak activation patterns that cannot be detected with existing methods. Third, we show that the 
structure of the hierarchical dependency grapli governing the activation process, and hence the network 
transform, can be learnt from very few (logaxithmic in network size) independent snapshots of network 
activity. 

1 Introduction 

We consider the problem of detecting a weak binary pattern corrupted by noise that is observed at the p 
nodes of a network: 

yi = jiXi + Ci i = l,...,p 

Here yi denotes the observation at node i and x = [xi, . . . , Xp] € {0, 1}^ is the p-dimensional unknown binary 

activation pattern, ii > denotes an unknown signal strength, and the noises {cj} ~ A/'(0, a^), the Gaussian 
distribution with mean zero and variance a^. The condition Xi = 0, i = 1, . . . ,p, is the baseline or normal 
operating condition (no signal present). If Xi > for one or more «, then a signal or activation is present in 
the network. We are interested not in arbitrary patterns of activation, but rather our focus is on patterns 
that are related to the physical structure of the network and/or to other statistical dependencies in the 
signal. This is motivated by problems arising in practice, as discussed below. More specifically, we consider 
classes of patterns that are supported over hierarchically-structured groups or clusters of nodes. Such a 
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hierarchical structure could arise due to the physical topology of the network and/or due to dependencies 
between the nodes. For example, hierarchical dependencies are known to exist in gene networks due to 
shared regulatory pathways (l][2], empirical studies show that Internet path properties such as delay and 
bandwidth are well-approximated by tree-embeddings [S] , sensor networks are often hierarchically structured 
for efficient management [4|, and communities in social networks can be hierarchical p]. We address the 
problem of detecting the presence of weak but structured activation patterns in the network. This problem is 
of interest in several applications including detecting incipient congestion or faint traces of malicious activity 
in the Internet, early detection of a chemical spread or bio-hazard by a sensor network, identification of 
differentially expressed set of genes in microarray data analysis, or malicious groups in social networks. 

If X is known, then the optimal detector is based on aggregating the measurements of the locations known 
to contain the signal (e.g., in the classical distributed detection literature it is often assume that Xi = 1 for 
all i OT Xi — for alH [5^). We are interested in cases where x is unknown. If x is arbitrary, this is a problem 
in literature known as the multi-channel signal detection problem [6]. In this case, global aggregation rule 
(testing the average of all node measurements) can reliably detect any signal strength ^ > if the number of 

active locations ||x||o > y^. This is because ^ J2i=i Vi ^ ('^^v^' ''^^) ' ^"^^ therefore as the network size 
p grows, the probability of false alarm and miss can be driven to zero by choosing an appropriate threshold. 
However, in the high-dimensional setting when p is very large and the activation is sparse ||x||o < y^, then 
different approaches to detection are required. If the signal strength /i > \/2a'^ logp, then the signal can 
be reliably detected using the max statistic maxj y^, irrespective of the signal sparsity level. This is because 
if there is no signal, the max statistic due to noise alone (maximum of p iid A/'(0, cr^) random variables) 
is < \/2a'^ logp with probability 1, in the large p limit. Therefore, the most challenging case is when the 
network activation is 

weak: /i < \/2a'^ logp and sparse: ||x||o < ^Jp 

In this case, the signal is buried in noise and cannot be detected in per node measurement or in global 
network-wide aggregate. This necessitates selective and adaptive fusion where the node measurements to 
be aggregated are chosen in a data-driven fashion. One approach that is common in the signal processing 
literature is to consider the generalized likelihood ratio test (GLRT) statistic maXxg{o_i}p x^y/x^x where 
the observed vector is matched with all 2"^ possible true activation patterns. However, in high-dimensional 
settings, the GLRT is computationally intractable. For weak and sparse signals, the limits of detectability 
were studied by Ingster [6], and subtle tests that are adaptive in various ranges of the unknown sparsity 
level were investigated. More recently, test statistics have been proposed [7]|8| that can attain the detection 
boundary simultaneously for any unknown sparsity level. A generalization of this problem has also been 
studied in |9j. However, all the work above assumes that the activations at nodes are independent of each 
other. As a result, the signal strength /i must be > cyTogp for some constant c > and hence the signal 
cannot be too weak. 

The assumption of independent activations is often unreasonable in a network setting, where the obser- 
vations at nodes tend to be highly dependent due to the structure of the network and/or dependencies in the 
activation process itself. For example, routers in the same autonomous system will show similar variations 
in round-trip-time measurements, or co-located sensors monitoring an environmental phenomena will have 
correlated measurements. Recently, there has been some work aimed at structured patterns of activation in 



graphs 10-12 , which indicates that it is possible to detect even weaker signals by leveraging the statistical 
dependencies in the activation process. Of these, the lattice-based models in |T2| are most closely related to 
our work, but they do not capture the hierarchical structure we have in mind, nor do they appear to offer a 
computationally tractable approach to detection. We also mention the recent work of [l3], which establishes 
fundamental limits of detectability for several classes of structured patterns in graphs. The detection tests 
proposed in that paper are generally combinatorial in nature (like the GLRT mentioned above), requiring 
a brute-force examination of all patterns in each class, and therefore are computationally prohibitive in all 
but very low-dimensional situations. 

In this paper, we consider a different class of patterns that reflects the hierarchical dependencies present 
in many real-world networks and leads to computationally practical detection methods. Furthermore, we 
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demonstrate that it is possible to learn the hierarchical dependency structure of the class from a relatively 
small number of observations, adding to the practical potential of our framework. The hierarchical de- 
pendencies structures we consider tend to results in network activation patterns that are supported over 
hierarchically-organized groups or clusters of nodes. We will show that such structured activation patterns 
can be sparsified even further by an orthonormal transformation that is adapted to the dependency structure. 
The transform concentrates the unknown x in a few large basis coefficients, thus facilitating detection. We 
show that if the canonical domain sparsity ||x||o ^ p^^" and the transform domain sparsity scales as p^~^ , 
where /3 > a, then the threshold of detection scales as /i > p-(/3-")/2.^2(T2 logp. Contrasting this with the 
detectability threshold of earlier methods fi > ^Iriau"^ logp (b]!?] (where < t^q. < 1 is independent of p), we 
see that a polynomial improvement is attained if the activation pattern is sparser in the transform domain. 
Hence, by exploiting the hierarchial structure of x, we can detect extremely faint activations that could not 
be detected using existing methods. 

Our contributions are three-fold. First, wc propose a sparsifying transform based on hierarchical clus- 
tering that is adapted to the dependency structure of network measurements. We propose a practically- 
motivated generative model that allows for arbitrary activation patterns, but favors patterns that are sup- 
ported over hierarchically-organized groups of nodes. We show that patterns from this model are compressed 
by the sparsifying transform. Though we focus on the detection problem in this paper, the sparsifying trans- 
form could be exploited in other problem domains, e.g. de-noising, compression, sparse regression, variable 
selection, etc. Second, we establish that the sparsifying transform can amplify very weak activation patterns 
by effectively performing adaptive fusion of the network measurements. Since the network activity is sum- 
marized in a few large transform coefficients, the signal-to-noise ratio (SNR) is increased, and this facilitates 
detection of very weak activation patterns. We quantify the improvement in the detection threshold relative 
to existing methods. The detection method we propose is a constructive procedure and computationally 
efficient. Third, we do not necessarily assume that the graph structure is known a priori, and show that the 
dependency structure, and hence the sparsifying transform, can be learnt from very few, O(logp), multiple 
independent snapshots of network measurements. 

The rest of this paper is organized as follows. In section [2j we introduce the sparsifying transform. 
We propose a generative model in Section [3] for hierarchically-structured patterns, and characterize the 
sparsifying properties and detection threshold attained by the proposed transformation. Section [4] examines 
the sample complexity of learning the hierarchical dependencies and transform from data. Simulations are 
presented in Section [5] Proofs sketches are given in the Appendix. 

2 Hierarchical structure in Networks 

As discussed in the introduction, activation patterns in large-scale networks such as the Internet, sensor, 
biological and social networks often have hierarchical dependencies. This hierarchical dependency structure 
can be exploited to enable detection of very weak and sparse patterns of activity. In this section, we propose 
a transform that is adapted to a given set of pairwise similarities between nodes. The similarity of node i 
and i is denoted by r^-. For example, rij could be the covariance between measurements at node i and j, 
but other similarity measures can also be employed. The transform is derived from a hierarchical clustering 
based on the similarity matrix {r^j}. If the matrix reflects an underlying hierarchical dependency structure, 
then the resulting transform sparsifies activation patterns supported on hierarchically-organized groups of 
nodes. 

2.1 Hierarchical Clustering of Nodes 

We employ a standard, bottom-up agglomerative clustering algorithm. The algorithm takes as input a set 
of pairwise similarities \rij\ and returns a hierarchical set of clusters/groups of nodes, denoted as 'H.. The 
algorithm is described in Figure [T] Suppose instead that we are given a hierarchical set of clusters H*. What 
conditions must a similarity matrix satisfy, in relation to "H.* , so that the agglomerative clustering algorithm 
recovers "H* and not some other hierarchical clusters? This is an important question for several reasons as 
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we will see in subsequent sections (e.g., to robustly identify T-L* from a noisy observation of the similarity 
matrix). To answer this question first note that the agglomerative clustering algorithm always merges two 
clusters at each step. Therefore, the most we can hope to say is that under some conditions on the similarity 
matrix, the agglomerative clustering algorithm produces a hierarchical set of clusters such that T-L* C T-L\ 
i.e., % contains all cluster sets in "H*, but may include additional subsets due to the restriction of binary 
merging. The following lemma gives a sufficient condition on the similarity matrix to guarantee that this is 
the case. The proof is straightforward and omitted to save space. 

Lemma 1. Suppose we are given a collection of hierarchical clusters %* . If for every pair of clusters 
{c,c') S W , where c' C c, the maximum similarity between any i a d and j g c/c' is smaller than the 
minimum similarity between any pair of nodes in c' , then the agglomerative clustering algorithm of Figure^ 
recovers %* . 



2.2 Hierarchical Basis for Network Patterns 

Based on a hierarchical clustering of network nodes, we propose the following unbalanced Haar basis repre- 
sentation for activation patterns. When two clusters ci and C2 are merged in the agglomerative clustering 
algorithm, a normalized basis vector is defined (up to normalization) by 

1 1 

|C2| |ci| 

where la denotes the indicator of the support of subcluster a. Projecting the activation pattern x onto this 
basis vector computes a difference of the average measurement on each constituent cluster. As a result, the 
basis coefficient b-^x is zero if the nodes in the constituent clusters are all active or inactive. Thus, the basis 
vectors possess one vanishing moment akin to standard Haar wavelet transform, and will sparsify activation 
patterns that are constant over the merged clusters. This procedure yields p — 1 difference basis vectors. 
These basis vectors are augmented with the constant vector that computes the global average. The resulting 
vectors form the columns of an orthonormal unbalanced Haar transform matrix B. 

The proposed method of hierarchical clustering followed by basis construction is similar in spirit to the 



recent work of Lee et al. 14 on treelets and of Murtagh 15 . However, treelets do not lead to a sparsifying 
transform in general if the node measurements or aggregates have different variances. The work of Murtagh 
uses balanced Haar wavelets on a dendrogram and does not yield an orthonormal basis since the basis vectors 
are not constant on sub-groups of nodes. As a result, the transform coefficients are correlated and dependent, 
making the resulting statistics difficult to analyze. Our procedure, on the other hand, is based on unbalanced 
Haar wavelets which are constant on sub-groups of nodes and thus result in orthogonal vectors. 



2.3 Activations of Hierarchically-Organized Groups 

To illustrate the effectiveness of the proposed transform, consider activation patterns generated by the union 
of a small number of clusters of the hierarchical collection H, i.e. let x — ly™ a, where Ci G T-L. Then it 
is not difficult to see that the transform of x will produce no more than 0{m) non-zero basis coefficients. 
The magnitude of each coefficient will be proportional to the square-root of the number of nodes in the 
corresponding cluster on which the basis is supported. Suppose that the largest cluster contains k nodes. 
Then the largest coefficient of x will be on the order of \/k. This implies that the corresponding coefficient 
of the noisy observations y will have a signal-to-noise energy ratio (SNR) of order fc/cr^, compared to the 
per node SNR of l/u^ in the canonical domain, making the activation much more easily detectable. 

In practice, actual activation patterns may only approximate this sort of ideal condition, but the transform 
can still significantly boost the SNR even when the underlying activation is only approximately sparse in 
the transform domain. In the next section we propose a practically-motivated generative model capable of 
generating arbitrary patterns. As the parameter of the model is varied, the patterns generated from the 
model tend to have varying degrees of sparseness in the transform domain. 
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Input: Set of all nodes £ = {1, . . . ,p} and pairwise similarities {rij}ijec 

Initialize: Clusters C = {{!}, {2}, . . . , {p}}, 
Hierarchical clustering T-L =C, Basis B = [ ] 

while \C\ > 1 

Select (ci, C2) 



end 
b = 



argmaxe„c,6C |ci||c2| 



Merge c = ci U C2 

, , n=HU{c} 
Update c = (C/{ci,C2})U{c} 

Construct unbalanced Haar basis vector: 



[B|b] 



C2 



/\c\ 

Output: B, ^ 



b] 



Figure 1: Algorithm for hierarchical clustering. 



3 Sparsifying and Detecting Activations 

In this section, we study the sparsifying capabilities of the proposed transform, and the corresponding 
improvements that can be attained in the detection threshold. For this, we introduce a generative model 
that, with high probability, produces patterns that are approximately sparse. 



3.1 A Generative Model for Activations 

We model the hierarchical dependencies governing the activation process by a multi-scale latent Ising model, 
defined as follows. Let T* = {V, E) denote a tree-structured graph with V as the vertex set and E as 
the edge set. For simplicity, we assume that the degree of each node is uniform, denoted as d, and let 
L = log^ p denote the depth of the tree. The leaves C of the tree are at the deepest level L and correspond 
to the network nodes, while the internal vertices characterize the multi-scale dependencies between the node 
measurements. Let z denote a |y|-dimensional vector of variables defined over the complete tree, but we 
only observe x = {zi}i^c^ the j>dimensional vector of network observations. We assume that z (and hence 
x) is generated according to the following probabilistic Ising model: 

}3(z) DC exp I ^ 7£ ^ [ziZ^(i) + (1 - Zi){l - j 

Here Vt denotes the vertices at level and 7^ > characterizes the strength of pairwise interaction between 
a vertex i at level t and its parent 7r(i). This model implies that the 2^' possible activation patterns are 
not equiprobable, and the probability of a pattern is higher if the variables agree with their parents in the 
tree dependency graph T* ■ This is a natural model for several application domains where the activation is 
governed by a contact process, e.g. the spread of an infection or disease. 
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3.2 Canonical and Transform Domain Sparsity 

To evaluate the transform domain sparsity, we first establish that the latent tree dependency graph T* 
can be recovered by the agglomerative hierarchical clustering algorithm of Figure IT] Based on a result by 
Falk ^16|, the covariance between any two leaf variables i and j is proportional to nj^^,^-|^(tanh 7^)^, where 
^' denotes the level of the root of the smallest subtree containing i and j (i.e. smallest cluster containing 
i and j). Thus, if the covariance is used as the similarity measure, it is easy to verify that it satisfies the 
conditions of Lemma [l] This is important since the covariance could be estimated from observations of the 
network. We have the following result. 

Proposition 1. The agglomerative hierarchical clustering algorithm of Figure^ perfectly recovers the tree- 
structured dependency graph T* on which the Ising model is defined, when using covariance between the leaf 
variables as the similarity measure. 

We now show how the unbalanced Haar basis built on the tree dependency graph T* leads to a sparse 
representation of binary patterns drawn from the multi-scale Ising model. Recall that a transform coefficient 
is zero if the activation pattern is constant over the support of the corresponding basis vector. 

Theorem 1. Consider a pattern x drawn at random from a latent Ising model on a tree- structured graph 
with uniform degree d and depth L = log^ p, as described in the previous section. If the interaction strength 
scales with the level £ as = (-P log d where < /? < 1, then with probability > 1 — 5, the number of non-zero 
transform coefficients are bounded by 

p^xllo < 3d(log,p)V^^. 

for p large enough. 

Proof is given in the Appendix. Since the interaction strength increases with level, variables at deeper 
levels are less likely to disagree with their parents and hence activation patterns supported over groups of 
nodes are favored. The above theorem states that, with high probability, patterns generated by this model 
are approximately sparse in the proposed transform domain. The degree of sparsity is governed by (3, the 
rate at which the interaction strength increases with level. 

We also have in mind situations in which the number of total activations in the network is small, i.e., 
||x||o < s/p, which renders the naive global fusion test statistic unreliable (see discussion in Introduction). 
To make widespread activations less probable, we constrain the Ising model as follows. Set the root vertex 
to the value 0. Let £0 = ^L, where < a < /3. Let 7^ = ipiogd for i > £q, and 7^ = 00 for £ < £q. This 
model forces variables at scales coarser than £0 to be identically 0. Proof of the following theorem is given 
in the Appendix. 

Theorem 2. Consider a pattern x drawn at random from a latent Ising model on a tree- structured graph 
with uniform degree d and depth L = log^p. Let £q = ^L, where < a < /3, and the interaction strength 
scale with the level £ as = £j3 \ogd for £ > £0, and — 00 for £ < £q. If the pattern corresponds to the root 
variable taking value zero, then with probability > 1 — 4(5 and for p sufficiently large, the number of non-zero 
transform coefficients are bounded by 

||B^x||o < 3d(log<,p)V-'', 
and the canonical domain sparsity is bounded as 

cp^-"< ||x||o<C(log,py-", 

where C > c> are constant. 

The result of the theorem states that the transform domain sparsity scales as p^~^ (and is therefore 
determined by the rate at which the interaction strength increases with level), while the canonical domain 
sparsity scales as p^^" (and is therefore determined by the smallest interaction strength between a variable 
and its parent). Since /3 > a, the proposed transform enhances the sparsity of canonically sparse patterns 
that have a multi-scale group structure. In the next section, we show that this enhanced sparsity implies a 
higher Signal-to-Noise (SNR) ratio in the transform domain, thus facilitating detection. 
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3.3 Threshold of Detectability 

Recall that the observed data is given by the following additive noise model: 

yi= HXi + ei i = l,...,p 

where /i denotes the unknown signal strength, x is the unknown activation pattern, and ti A/'(0,cr^). The 
detection problem corresponds to the following hypothesis test: 

i/o : = vs. Hi : ^> 

Projecting the network data onto the basis vectors b e B yield the empirical transform coefhcients 
b^y. If the pattern x is sparser in the transform domain, then its energy is concentrated in a few non-zero 
coefficients. Thus, the signal-to-noise ratio is boosted and detection is easier. To investigate the threshold of 
detectability for weak but structured activation patterns, we consider a simple test based on the maximum 
of the absolute values of the empirical transform coefficients max^ \hfy\ as the test statistic. The following 
theorem provides an upper bound on the detection threshold using the max statistic in the transform domain 
for patterns drawn from the tree-structured Ising model. 

Theorem 3. Consider a pattern x drawn at random from a latent Ising model on a tree- structured graph 
with uniform degree d and depth L — log^p. Let £o = and the interaction strength scales with the level i 
as 7£ — i/S log d for £ > £o, and — oo for £ < £q. 

With probability > 1 — 26 over the draw of the activation pattern, the test statistic max^ |b^y| drives the 
probability of false alarm and miss (conditioned on the draw of the pattern) to zero asymptotically as p oo 
if the signal strength 

fi> c p~'^^/2a^ logp, 
where k = {l3 — a)/2 > and c > is a constant. 

Proof is given in the Appendix. We see that a polynomial improvement is attained if the activation 
pattern is sparser in a network transform domain. This is a significant improvement over canonical domain 
methods that do not exploit the structure of patterns and are limited to detecting signals with strength 
fi > \/2r\aa'^ logp (where < rya < 1 is independent of p) ^^^^ ■ 

4 Learning Clusters from Data 

In practice, the pairwise similarities or covariances used for hierarchical clustering and constructing the 
proposed transform can only be estimated from data. Since the empirical covariance between network 
nodes can be learnt from multiple i.i.d. snapshots of network measurements, we now provide finite sample 
guarantees on the recovery of the multi-scale dependency structure from empirically estimated covariances. 
Analogous arguments can also be made for any similarity measure provided the empirical estimates satisfy 
a concentration inequality. 

Theorem 4. Consider noisy network measurements as per the following additive noise model: 

yi^Xi + e., i^l,...,p 

where are independent J\f(0,a^). The Xi are independent of the noise variables e^, and are uniformly 
bounded by M . For simplicity, we assume that the variables Xi are also zero-mean. Dependencies between 
the {xi\^^^ possess a hierarchical structure. Specifically, assume the covariances {^[{xiXj)]} satisfy the 
conditions of Lemma ^ for a hierarchical set of clusters H* . Let r denotes the smallest difference (gap) 
between the minimum pairwise covariance of leaf variables within any cluster and the maximum covariance 
between leaf variables in different clusters. Also, let r.ij — E[{yiyj)] = E[{xiXj)] + a'^Sij, where Sij is the 
Kronecker delta, denote the true covariance of the observed variables. Notice that the noise only affects 
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the auto-covariances which are irrelevant for clustering, and hence rij essentially behaves as V,[{xiXj)] for 
clustering purposes. 

Suppose we observe n i.i.d noisy realizations {yf\---,y'p^}^^i of the p leaf variables, and {rij = 
^^^^lu'i'^f^} denote the empirical covariances. Let S > 0. If 

n 1 

logn C2T^ 

then with probability > \ — 5, the agglomerative clustering algorithm of Figure^ applied to {r^} recovers 
Ti* . Here Ci,C2 > are constants that depend on M and . 

Recall that p denotes the number of network nodes. The theorem implies that only O(logp) measurements 
are needed to learn the hierarchical clustering and hence the proposed transform. 



5 Simulations 

We simulated patterns from a multi-scale Ising model defined on a tree-structured graph with p = 1296 
leaf nodes with degree c? = 6 and depth L = 4. The network observations are modeled by adding additive 
white gaussian noise with standard deviation cr = 0.1 to these patterns. This implies that a weak pattern 
is characterized by signal strength fi < a^/2\ogp — 0.38. We generate weak patterns with signal strength 
fi varying from 0.06 to 0.2 and compare the detection performance of the max statistic in transform and 
canonical domains, and the global aggregate statistic, for a target false alarm probability of 0.05. We 
also compare to the FDR (False Discovery Rate) fT7| which is a canonical domain method that orders the 
measurements and thresholds them at a level that is adapted to the unknown sparsity level. The probability 
of detection as a function of signal strength is plotted in Figure [2j Detection in the transform domain clearly 
outperforms other methods since our construction exploits the network node interactions. 

The algorithmic complexity of hierarchical clustering p objects is 0{p^ logp), which essentially dominates 
the complexity of the detection procedure we propose. 



Appendix 

Proof of Theorem [T] 

Each unbalanced Haar basis vector b G B (except for the global summary vector has one vanishing 

moment, i.e. — 0. Therefore, the only basis vectors with non-zero coefficients are the ones whose support 
contains a pair of nodes with different activation values. The number of node pairs with different activation 
values can be bounded by the total number of edge flips (variables that do not agree with their parent 
variables) in the tree. Let De denote the number of edge flips at level £. Since there are no more than 
dL basis vectors supported on a node pair with different activation values, the total number of non-zero 
coefficients H]B-^x||o < dLJ2eDe. 

Now observe that the tree-structured Ising model essentially specifies that edge flips are independent and 
occur with probability — 1/(1 + e'^'^) = 1/(1 -I- d^^) at level £. That is, the number of flips per level Dg ~ 
Binomial ( I iSf I, qi) where Eg (= d^) denotes the number of edges at level £. Let £' = L{1 — 13) = (1 — /3) \og^p. 
Now d^^^~^'^ /2 < \Ee\qe < d^^^~^\ and therefore \Ee\qe — oo as p — > oo for all ^ > £' . Invoking the relative 
Chernoff bound, we have: For any £ > £' , with probability > 1 — 6/L, 2~^\Ei\qi < Dg < 2\Et\qi for p large 
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Figure 2: Performance comparison of global fusion, FDR, and tlic max statistic in transform and canonical 
domains, for weak patterns generated according to a hidden multi-scale Ising model. 

enough. We can now derive the following bound which holds with probability > 1 — 6 

(e' L 

I eJ L 



i=i 



e=i'+i 

L 



i=e'+i 



Proof of Theorem [2] 



0. Following the the proof of 



For ^ < 7£ = CO implies that the probability of edge flip at level I, qi 
Theorem [T] the bound on the transform domain sparsity still holds. 

To evaluate the canonical domain sparsity, we condition on patterns for which the root variable is zero 
(inactive). Let denote the number of variables that are active (take value 1) at level £. Since qi ~ Q 
for ^ < ^0, there are no flips and hence no variables are active up to level i-e. = for i' < ^o- We 
essentially argue that the canonical sparsity is governed by the number of nodes that are activated by flips 
at level (.q. Flips at lower levels might act ivate/de- activate some of the nodes but their effect is insignificant. 

First, observe that the number of active variables at level conditioned on the root variable being 
inactive, is simply the number of edge flips Di^ at level £o; i-e. Ai^ = Di^^. Consider I > £q. Let Mi denote 
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the number of active variables at level £ whose parents were inactive, and let dcinotc; the number of active 
variables at level £ whose parents were also active. Therefore, = + N^. Observe that, conditioned on 
the values of the variables at level £ — 1, 

Me\Ae-i ~ Binomial((|i;£_i| - At-i)d,qe) 

Ni\Ai_i ~ Binomial(^^_i(i, 1 — qg) 

To gain some understanding for the canonical sparsity, we first look at the expected canonical sparsity. Note 
that E[i|xj|o] = E[Al] = E[E[Al\Al-i]] = E[E[Ml + Nl\Al-i]]. 
For the lower bound, we proceed as follows. 

E[Al] > E[E[NL\AL_r]] > - ql) 

Now, repeatedly applying similar arguments for i > Iq, wc get: 

E[||x||o] > E[AeM''-'"'[if>,,a-Qi) 

- 2 ^ ^ 

where c < 1. The second step uses the fact that 1 — qe decreases with £, and that A^^ = D^^ 
Binomial ( I i^^P I, q^^). The last inequality holds for large enough p. 
For the upper bound, we proceed as follows. 

E[Al\ = E[E[Ml+Nl\Al-i\] 

= E[{\El-i\ - AL_i)dqL + AL_id{l - qL)] 
< \EL-l\dqL+E[AL-i]d 

Repeatedly applying similar arguments for i > £o, we get: 

E[||x||o] < ^ liJi-fl/gL-.+i+EiA^^ld^-^o 

< '^Y.d^d-^^-'+'^^ + \E,Mtod''-''' 

< (L + < C(logrfp)pi-", 

where C > 1. The second step uses the fact that Aig = D^g ^ Binomial(|£'^„|,<7£j,). 

We now show that similar bounds on canonical sparsity hold with high probability as well. For this, 
we will invoke the relative Chernoff bound for binomial random variables and Nf . First, we derive a 
lower bound on Ag for £ > £q recursively as follows. Recall that A^^ = Dig ^ Binomial(|i?£j,|,<7£j,) and using 
relative Chernoff bound as in the previous proof, w.p. > 1 — 6/L, A^^ = D^^ > E[Dgg]/2 = \Eig\qig/2 > 
d^o(i-^)/4^ oosince^o = f = f log^P^ oo. Now^^„+i > Ne,+i. AndE[7V^„+i|A^J = AiJ{l-qi,+i) > 
Ai„d{l-qig) > Aigdil-d-'^"'^) = A(„d(l-p''°'). Thus, E[Ar£„+i|A£j oo w.p. >1-S/L. Conditioning on 
the values of the variables at level £o and using relative Chernoff bound, we have with probability > 1 — 26 /L, 
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where 



/ 3log{L/5) I 3log{L/5) 

< c' p~53(^-'^)^loglogp < 1 

for p large enough and c' > is a constant. Notice that A^^+i — *• oo with probabiUty > 1 — 2S/L. 

Now consider any £ > £q and assume that for all £ > i' > £q, A^i > — — ef), where 

Q' < c'p~ ^^^~^'> y/log \ogp < 1, and A^r oo with probability > 1 - {£' - £o + 1)S/L. We show that similar 
arguments are true for A(+i. Recall that A^^i > Ni+i. And E[A^^+i|y4£] = Afd{l — qe+i) > Agd{l — qig) > 
A£d{l — p^"). Thus, E[A'£-|-i l^^] oo w.h.p. since A( x. Now, conditioning on the values of the 
variables at level £ and using relative Chernoff bound, we have with probability > 1 ~ {£ — £o + 2)5/ L, 

At+x > Ni+i > E[N(+i\Ae]{l - ee+i) > Aed{l - - ee+i) 



where 



= /1MMI< / 31og(L/<5) 



< 



E[Ne+i\Ae] " V Aid{l-p-'^) 
31og(L/5) 



Ae,{l-p—y+-^-^odi+i-eoUj,^^^^,{l - ee) 

< c'p~ ft ^J\0g\0gp 

The last step follows by recalling that > d^°(i-'5)/4 = pf (i-^^) /4 and (l-p-")<^+i-^o > (i_p-")i+i-^o = 
> c' for large enough p. Also, < 1/2 for large enough p and hence d^+i-^''n|,^^^_^i(l- 

ee,) > d{d/2y-^" > 1. 

Thus we get, with probability > 1 — 5, for all £ > £o 

A, > A,,d^-^o(l -p-")^-^on^,^,„+,(l - e,) 

where e^/ < c'p~ 2? (i - ^log log p < 1. Finally, we have a lower bound on the canonical sparsity as follows: 
With probability > 1 — 5, 

||x||o=Ai > ^^„d^-^°((l-p-")(l-c>-^logp))^-^<' 
> crf^°(i-'5)d^-^° = cd'^d-^'^P = cp^-" 

where we use the fact that (1 — p~°-y°SdP > c > for large enough p. Also note that c < 1. 

We now establish an upper bound on the canonical sparsity. Recall that Ag = + Ng. In the analysis 
above, we established that E[A^^|j4£_i] — >• 00 for each £ > £0 w.p. > 1 — 6/L. Now consider Mg. We show 
that E[Af£|v4^_i] 00 w.p. > 1 — S/L, and derive an upper bound on Ag for £ > £0 recursively as follows. 
Recall that Ai^^ = Dg^ ^ Binomiald-E^^ |, g^^) and using relative Chernoff bound as in the previous proof, 
w.p. > 1 - d/L, Ae„ = Dg„ < 2E[De„] = 2\Ei„\qe„. Now E[Me„+i\Ae„] = i\Ee„\ - A,,)dqt,+i > - 
2qe,)dqe„+i > d(^«+i)(i-'5)(l - 2d-^°^)/2 = d«?o+i)(i-/3)(i _ 2p-")/2 00 since 4 = |L = | log^p 00. 
Thus, E[M£j,+i|^£„] 00 w.p. > 1 — S/L. Conditioning on the values of the variables at level £0 and using 
relative Chernoff bound, we have with probability > 1 — 4:6 /L, 

^io+i = ^Ho+i + Meo+i 

< (l + e,„+i)(E[7V,„+i|A,J +E[M,„+i|A,J) 

< + eeo+i){Aeo + \Eio\qeo+i)d 
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where 



e<!o+i 



max 



< max 



31og(L/5) 



31og(L/5) 



E[Ne,+,\AeSynMi,+i\Ae„ 



31og(L/5) 



61og(i/5) 



^(«o+l)(l-/3)(l _ 2p-«) 



for p large enough and c' > is a constant. Now consider any i > io and assume that for all £ > £' > £o, with 
probability > 1 - 2(f - £o + 1)6 /L, E[M^/|A^/_i] -s- oo and 

< (1 + ee'){Ai,_i + \Ee'-i\qe')d, 

where < c'p~ ^ \/log logp < 1- We show that similar arguments are true for A^+i. Recall that 
Ag+i = iVf+i + M^+i. Using the upper bound on A^i for £> £' > £q recursively, we have with probability 

> 1 - 2(£ - 4 + 1)<5/L, 

nMi+AM\ = {\Et\- Af)dqt+t 

> \Ee\dqi+i - (1 + ee){Ae_i + \Ei_i\qe)d^qe+i 

I 

> \Ei\dqe+i- Yl \Et'-i\qi'd^+^-^'qt+iJl\„^^,{l + ei„) 



> rf(^+l)(l-/3) 



-3Ld-^°^{l+c'p-^'-^- 
- 3Lcp~ 



' logpY 



00 



The second last line uses the fact that £ - £o < L - £o = {1 - f) log^p and (1 +p-''y°Sdi 
a constant, for p large enough. The last step follows for large enough p and since £ > £qjL = j log^p — >■ oo. 
Thus, E[M^+i|A£] — )• oo w.h.p. Now, conditioning on the values of the variables at level £ and using relative 
Chernoff bound, we have with probability > 1 — 2[£ — £q + 2)5 /L, 

Ae+i = Ni+i + Me+i 

< (l + e^+i)(E[7V,+i|A,]+E[M^+i|^^]) 

< {1 + ee+i){Ai + \Ee\qe+i)d 

where 



max 



< max 



31og(L/<5) 31og(L/<5) 



E[Ne+i\Aey V E[Me+i\Ai] 



31og(L/5) 



6\ogiL/5) 



Aed{l - p-") ' Y (i(^+i)(i-/3)(l - 6Lcp-") 
< c' p~5?^^~''Vloglogp < 1 
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for p large enough. 

Thus using recursion wc get, with probabihty > 1 — 2(5, for aU ^ > £o 

t 

e'=io+i 

where C > 1 is a constant. Last step uses the fact that < c'p~ 5^(1"^) Vlog log p, and (1 + p~°-y°SdP'' < 
gP logdP < c, a constant, for p large enough. Finally, we have an upper bound on the canonical sparsity 
as follows: With probability > 1 — 2S, 

Mo ^Al< Cd^d-'^"'^ = Cp^-"". 

Proof of Theorem |3] 

Consider the threshold t = ■\/2(t2(i -|- q) logp, where c > is an arbitrary constant. Since the proposed 
transform is orthonormal, it is easy to see that under the null hypothesis Hq (no activation), the empirical 
transform coefhcients hfy ^ Af{0, cr^). Therefore, the false alarm probability can be bounded as follows: 

PH,(max|bfy|>t) = l-nf.,P«.(|bfy|<t) < 1 - (1 - 2e-'''="')' 

Under the alternate hypothesis Hi (x 7^ 0), the empirical transform coefficients hfy ^ J\f{fihfx,a'^). 
Therefore, the miss probability can be bounded as follows: 

Pff,(max|bfy| <t) < n,^b-x^oP(|AA(Aibf x, a^)] < i) 

< n,.bfx>o^(A^(Mbf X, a^) < t) ■ n,,bT,<o^(A^(Aibf X, a^) > -t) 

= n,;^bfx>o^(A^(0, 'J^)<t^ M|bf x|) • n,^bf x<o^(A^(0, <J^) >-t + M|bf x|) 
= n,^b-x^oP(AA(0,a2)<i-/i|bfx|) 

< P(7V(0, cr^) < t-Mmax|bfx|) 

i 

In the second step we use the fact that P{\a\ < t) < P{a < t) and also P{\a\ < t) < P{a > ~t). Thus, the 
miss probability goes to zero if /imax^ |b^x| > (1 + c')t for any arbitrary c' > 0. 

The detectability threshold now follows by deriving a lower bound for the largest absolute transform 
coefficient. We employ the simple fact that the energy in the largest transform coefficient is at least as large 
as the average energy per non-zero coefficient: 



max|b,^x| > ^||x||o/||B^x||o 

Now invoking Theorem [2] for patterns that correspond to the root value zero, with probability > 1 — 2S, 

max|bfx| > cp(^-")/2 

i 

where c > is a constant. Patterns that do not correspond to the root variable taking value zero are 
canonically non-sparse and have ||x||o larger than the patterns that correspond to the root variable taking 
value zero. Therefore, the same lower bound holds in this case as well. 
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Proof of Theorem |4] 

Observe that the true hierarchical structure %* between the leaf variables can be recovered if the empir- 
ical covariances {rij} satisfy the conditions of Lemma [l] Recall that {E[(a;iXj)]} satisfy the conditions of 
Lemma [l] and the true covariance of the observed variables = ¥\{yiyj)] — ¥\{xiXj)] for i ^ j (the 
auto-covariances are not important for clustering). Also, recall that t denotes the smallest difference (gap) 
between the minimum pairwisc covariance of leaf variables within any cluster and the maximum covariance 
between leaf variables in different clusters. Hence, a sufficient condition for the empirical covariances {r.ij} 
to satisfy the conditions of Lemma [T] is that the deviation between true and empirical covariance of the 
observed variables is less than r/2, i.e. 

max|fij - r„ | < t/2. (1) 
To establish Eq. [Tl we study the concentration of the empirical covariances around the true covariances. 

(k) (k) 

For this, we first argue that the random variable Vk ■= yl yj satisfies the following moment conditions: 

for integers p > 2 and some constant h > 0. We will make use the following three results (Lemmas 1-3 
from ||18)): 

1) If the even absolute central moments of a random variable satisfy the moment condition, then so do 
the odd moments. This implies that Gaussian random variables satisfy moment conditions since the 
even moments of A ~ A/'(yU, cr^) are given as 

E[\A~fi\^P] = 1.3.5 {2p~l)a^P. 



2) If two zero-mean random variables {A, B) satisfy the moment conditions and E[A_B] > 0, then A + B 
also satisfies the moment condition. 

3) If two zero-mean, independent random variables {A, B) satisfy the moment conditions, then AB also 
satisfies the moment condition. 



Now observe that 

= (.f^+ef))(xf -Kef) 

_ Sk)Jk) , (k) (k) (k) Jk) (k) (k) 
— x.j -r <zj -r Cj -r Cj c^- . 

We will now argue that each of the terms in the above expression satisfy moment conditions. Since \x^^^ \ , la^^'^'' | 

are bounded, xf\x''l^^ as well as the first term xf^x'^p satisfy the moment condition. Also, since ef\t'p 
are gaussian, they satisfy the moment conditions as per result 1). And using result 3) above for the product 
of independent random variables, we see that the remaining three terms ^''^■'ef , ej'^^xj'^'', e^^^e'-'^ satisfy the 
moment conditions. Now it is not too hard to see that for any two terms A, B in the expression above, 
E[Ai?] > 0. Therefore, using result 2) above for the sum of random variables, we get that Vk satisfies the 
moment condition with some parameter h. Also, since {vk}^^i are independent, we can now invoke the 
Bernstein inequality to get: 



y k=i 



Wfe -E Wfe ) > — 
n 



\ 



^ var(wfe) 



—t 

< e * 



k=l 
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for < i < var(ufe)/(2/i). Now, straight-forward computations show that 



var(wfe) 



a^ + a^ (e [{xf^f 
2a^ + 4ct2e 



E 



(a:f')2]+var((xf))2) 



i=j 



Since ^ | < M, we have ci := cr'' < var(ufc) < 2(7-* + AA'Pa"^ + AM^ =: cg. And we get 



p^^K-EM)>^ 



< e 



Let t = \fnT I(\\jc2 log n), where r is the gap between the minimum pairwise covariance of variables within 
any cluster and the maximum covariance between variables in different clusters. Then we get: 



-nr j (16c2 log n) 



and < t = \/nT l{A,\Jc2 logn) < ^nci/{2h) < \/J2k=i ^^^i'^k)/i'^h) for large enough n and hence t satisfies 
the desired conditions. Similar arguments show that —Vk also satisfies the moment condition, and hence we 
get: 



P 



1 " 

-^K-EN) 



fe=i 



Equivalently, 



Pi\nj - nj \ > t/2) < 2e-"^ /(i6c2iogn) 
And taking union bound over all elements in the similarity matrix, we have that the 

P(max|f„- - nj\ > t/2) < 2p2e-"rV(i6c2 iog«)_ 

Thus, the covariance clustering algorithm of Figure [l] recovers H* with probability > 1 — S from 

n 16c2 



log n 



> 



log(2p75) 



i.i.d snapshots of leaf variables. 
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